Skip to content
2025 was a watershed year for UK cybersecurity. Not because of some future threat that experts had long warned about, but because it arrived, in broad daylight, and hit some of the most recognisable names in British business.
Marks & Spencer lost £300 million in operating profit after a ransomware attack in April that suspended online ordering for 46 days, wiped over £700 million from the company’s market value, and forced 65,000 employees to manage stock allocation on paper. Jaguar Land Rover halted all production at its Solihull, Halewood and Wolverhampton plants for five weeks from September, generating a £196 million direct cost and an estimated £1.9 billion impact on the broader UK economy (one of the most significant cyberattacks on UK industry in recent years). Co-op, Harrods and other major names were hit in the same period.
As a professional in the security industry, reading those figures is sobering. But what concerns me most is not the scale of the losses, it is how the attacks happened.
The Attack Vector Nobody Expected
In the M&S case, the attackers did not breach a firewall. They did not exploit an unpatched server vulnerability. They impersonated an employee and convinced a third-party service desk contractor to reset a password. With that one set of credentials, they moved laterally through the network for weeks before deploying ransomware. By the time M&S detected the breach, the attackers had already accessed the master list of every user account in the organisation.
The contrast with Co-op is instructive. The same group used near-identical tactics. Co-op detected the unusual account behaviour within minutes, their security operations centre was alerted immediately, and containment was underway within hours. Core customer-facing services stayed online. The difference was not in the sophistication of defences, it was in monitoring, segmentation, and response readiness.
The lesson from 2025 is not that cyberattacks are inevitable. It is that the gap between good and poor outcomes is determined by architecture, monitoring and preparation – not just spend.
Why Physical Security Systems Are a Specific Target
Your access control system manages digital credentials, stores biometric data, communicates continuously across your network, and makes real-time authentication decisions. Your CCTV infrastructure streams data to servers, receives firmware updates, and in many cases, connects directly to cloud management platforms. Your visitor management system logs individuals, links to identity databases, and often integrates with HR and IT systems.
These are not locks and cameras. They are networked IT systems that process sensitive data, and they have historically been managed with far less cybersecurity rigour than other enterprise IT infrastructure. They sit on the same networks as corporate data systems. They are often maintained by third-party contractors with broad access privileges. And they run on firmware that, in many estates, has not been updated in years.
This is the attack surface that adversaries are increasingly targeting, not as an end in itself, but as a route into the broader network. A poorly secured IP camera is a foothold. An access control panel with default credentials is a door.
The Convergence Gap
Physical and cybersecurity have traditionally operated in separate silos – different teams, different budgets, different reporting lines. The threat landscape no longer respects those organisational boundaries.
When physical and cyber security systems operate independently, there is no unified view. Your IT security team monitors network traffic but is not watching the access control logs. Your physical security team monitors door events but is not correlating them with unusual network activity. Suspicious credential use at an unusual time, in an unusual location, goes undetected because no single team has the full picture.
The M&S attackers exploited exactly this gap. The compromise began weeks before the ransomware was deployed. Legitimate credentials were used to move laterally through the network. The activity looked normal to each team monitoring only part of the environment.
What the Regulatory Environment Now Requires
The UK Cyber Security and Resilience Bill, introduced to Parliament in November 2025, reflects the government’s response to exactly these incidents. Building on the Network and Information Systems (NIS) Regulations 2018, the Bill expands the regulatory scope to explicitly include managed service providers and data centre operators, recognising that the risk runs through supply chains and third-party access, not just the organisations themselves.
Medium and large MSPs, including those providing IT helpdesk services, security monitoring and managed infrastructure support, will be brought into scope as Relevant Managed Service Providers, subject to mandatory incident reporting to the NCSC within 24 hours. Fines for serious non-compliance could reach £17 million or 4% of global annual turnover.
The supply chain dimension is particularly significant. The Bill gives regulators the power to designate specific suppliers as Critical Suppliers to essential services, imposing compliance obligations on organisations several steps removed from the regulated entity. The M&S attack, which entered through a third-party contractor, is precisely the scenario this provision is designed to address.
For organisations that rely on managed security services providers, including for physical security infrastructure, understanding your provider’s compliance posture is no longer a best-practice recommendation. It is becoming a regulatory obligation.
What a Cybersecurity-First Approach to Physical Security Looks Like
At Evolution, we have integrated cybersecurity thinking into physical security design for several years. The incidents of 2025 have accelerated the conversation with clients, but the technical approach is well-established.
Network segmentation as standard
Physical security devices (ie. cameras, access control panels, intercoms) should operate on dedicated, properly segmented network infrastructure. VLANs isolate security systems from corporate IT, contain compromise if a device is breached, and allow controlled access for maintenance without exposing the broader corporate network. We specify managed switches with port-level security as standard on all new installations.
Patch management that is managed
The most common finding in security estate audits is firmware that is months or years out of date. Manufacturers including Axis, Hanwha, Genetec, Milestone and Gallagher release security patches regularly. An unpatched device is a device with known, documented vulnerabilities that adversaries actively scan for.
Evolution’s Remote Managed Services monitor firmware versions across client estates, flags devices approaching end-of-support, and manages patch deployment during scheduled maintenance windows. This is not optional housekeeping, it is a fundamental component of a defensible security posture.
Zero trust access for security infrastructure
The credential theft that enabled the M&S attack could have been significantly mitigated by multi-factor authentication on administrative accounts and just-in-time access provisioning. The same principles apply to physical security management platforms. Administrative access to your VMS, your access control platform, and your cloud management console should require MFA, should be logged, and should be reviewed regularly.
Incident response planning that includes physical security
The Co-op’s successful containment was not accidental. It reflected regular war-gaming and crisis simulation that included physical security scenarios. Your incident response plan should include procedures for what happens when a physical security system is suspected of being compromised: how you isolate it, how you maintain physical access control during an outage, and who holds authority to make those decisions under pressure.
The Integration Imperative
The organisations that will navigate this threat environment most effectively are those that have closed the gap between physical and cyber security with unified threat monitoring, integrated response protocols, and a single view of events across both domains.
This does not require replacing your physical security estate. It requires connecting it to your SIEM, correlating access events with network activity, and ensuring that the team managing your physical security infrastructure understands the cybersecurity obligations that come with it.
The attacks of 2025 made one thing undeniably clear: physical security is IT security. The organisations that treat it as such are the ones that contain breaches in hours rather than weeks.
Concerned about the cybersecurity posture of your physical security estate? Contact Evolution to discuss a cyber-physical security assessment. We will evaluate your current architecture, identify the most significant exposures, and propose a prioritised remediation roadmap.